The Password Authentication Paradigm In today s business world, security in general - and user authentication in particular - are critical components

Transcription

1 YOUR ULTIMATE AUTHENTICATION SOLUTION A l a d d i n. c o m / e T o k e n

2 The Password Authentication Paradigm In today s business world, security in general - and user authentication in particular - are critical components in enabling business and protecting sensitive corporate information. By implementing strong user authentication solutions, you enable your customers, partners, and employees to boost their productivity by using your business applications wherever they are in the office, at home, or on the road. In a business world that requires your organization to be compliant with key industry regulations such as HIPAA, FDA, Sarbanes Oxley and Basel II, strong user authentication is a critical element in protecting information and individuals privacy. Passwords, the primary tool for user authentication, can be easily stolen, lost, shared or cracked. Due to the need to manage multiple passwords and to ensure the effectiveness of passwords used, organizations have adopted stringent password policies. This has translated into more complex passwords and consequently, made them more difficult to remember. To cope, users are writing their passwords down, compromising the security they were meant to improve. Aladdin s etoken suite of strong authentication and password management solutions ensures that only authorized individuals access an organization s sensitive information - enabling business, protecting data, lowering IT costs, and boosting user productivity. Source: IDC, «Worldwide Identity and Access Management Forecast and 2006 Vendor Shares, Doc. # , July, 2007 AUTHENTICATION etoken - Your Ultimate Authentication Solution Aladdin etoken provides strong authentication and password management solutions, offering: Enhanced security and ensured safe information access Cost-effective password management A means to safely carry your personal digital credentials with you, wherever you go About the size of an average house key, Aladdin etoken is an easy to use and highly portable USBbased smartcard device. It enables both users and IT/security administrators to more effectively manage the authentication process by securely storing passwords, PKI keys and digital certificates, and other personal credentials onboard the etoken. etoken provides strong two-factor user authentication Something you have - The etoken device Something you know - The etoken password 1 etoken Overview

3 etoken Solutions SOLUTIONS Today s business world demands that you have instant and secure access to all your sensitive business assets, at any time from wherever you are. More than that, it demands that you do more with less. etoken delivers a broad platform of solutions to enable greater standardization, with lower deployment and management costs. Secure Network Access Network Logon etoken enables strong user authentication when logging on to protected network resources, supporting both smartcard logon technology using PKI and the native Microsoft password-based logon mechanism by storing users access credentials. VPN Security (Secure Remote Access) etoken enables strong user authentication when remotely accessing the corporate network, offering seamless integration with leading VPN systems. etoken supports multiple VPN authentication methods including one-time passwords and digital certificates. Web Access etoken enables strong user authentication when accessing protected web resources and signing sensitive digital transactions. etoken supports multiple web authentication methods including one-time passwords and digital certificates. Data Security PC/Boot Protection, File & Data Encryption etoken offers seamless integration with many types of data protection systems, ranging from full disk encryption and boot protection, to specific folder and file encryption. Secure etoken offers encryption and signing with seamless connectivity to major clients using standard security features. Digital Signing (Non-repudiation) Transactions and documents can be digitally signed with etoken through PKI technology, ensuring the authenticity of electronic transactions. Password Management Enterprise Single Sign-On With etoken, users no longer need to remember passwords for different accounts their single etoken password combined with their etoken device is all they need to securely access their network, web, and Windows-based applications. etoken manages the user s credentials and automatically submits them to different application logon screens. A l a d d i n. c o m / e T o k e n 2

4 PRODUCTS etoken Product Offering The etoken product offering provides a robust and flexible framework for integration with many of today s leading security solutions, giving you a solution to all your strong authentication and password management needs. APPLICATIONS etoken Security Applications Strong Authentication etoken strong user authentication applications offer you the ultimate power and flexibility to secure access to your digital business resources. etoken provides strong user authentication by requiring both your personal etoken device (something you have) and your etoken password (something you know). Public Key Infrastructure (PKI) 3 etoken PKI capabilities enable you to authenticate yourself, encrypt, and sign digital information with full confidence. With etoken PKI capabilities you can securely access your corporate network, secure your personal files, carry out e-commerce transactions, sign your s, and much more all with perfect mobility and strong protection. etoken Overview

5 etoken enables you to simply and flexibly implement PKI-based strong user authentication and encryption solutions in the Windows, Macintosh, and Linux environments, by securely generating and storing PKI private keys and digital certificates onboard the token. One-Time Password (OTP) Authentication etoken One-Time Password (OTP) authentication offers secure clientless network logon using one-time passwords, giving you the versatility to securely log onto your network from wherever you are, without the need for any client software installation or a USB connection. The etoken OTP architecture includes the etoken RADIUS server for back-end OTP authentication, which enables integration with any RADIUS-enabled gateway/application, including leading VPN solutions, web access solutions, and more. The etoken RADIUS server utilizes the Active Directory infrastructure (via Aladdin TMS) for user information. etoken PKI and OTP authentication solutions include enterprise-level management with etoken TMS - The etoken Token Management System (TMS) enables full deployment and life-cycle management of all etoken devices and the authentication solutions associated with them in a single system. A l a d d i n. c o m / e T o k e n 4

6 Password Management etoken provides a secure token-based single sign-on solution for enterprises. With its set of easy-to-use applications, etoken enables you to securely store and manage all of your logon credentials on a single etoken device. You no longer need to remember numerous passwords for all of your applications and accounts - just your single etoken password. etoken Single Sign-On (SSO) etoken SSO secures and simplifies the logon process to all your enterprise and personal password-protected accounts - from initial network logon to entering your Windows-based and web-based applications - by securely storing your personal application logon credentials on the etoken smartcard and automatically submitting them during logon. All you need to do is connect the etoken to your computer and present your single etoken password to access all your protected applications. etoken SSO removes the burden of remembering multiple passwords from users, significantly reducing the work load on the IT help desk and increasing security. Users can easily manage complex, unique passwords for each application, and comply with even the most stringent organizational password policies. For added security and ease of use, etoken SSO supports automatic handling of application password change requests and assignment of random passwords. etoken SSO provides a simple, secure, and easy to deploy solution for managing passwords, inherently integrated with strong two-factor authentication. It requires no back-office integration or complex set-up efforts so you can quickly start reaping the benefits. etoken SSO includes robust enterprise level management - Beyond offering secure and convenient access to users, etoken SSO also provides intuitive, easy-to-use management tools so that you can fully manage your users SSO usage and enable the use of the etoken to securely access your home-grown applications. etoken SSO is fully integrated with Aladdin s etoken Token Management System (TMS), which provides administrators with a full suite of token management services including etoken deployment and revocation, user self-service password reset, backup/restoration of user credentials, and a solution for employee on the road lost token situations. 5 etoken Overview

7 etoken Web Sign-On (WSO) etoken WSO enables easy, convenient and secure storage and management of all of your web logon and access credentials. Your personal web form credentials can be securely saved on the etoken smartcard and accessed only by you. You no longer need to memorize all your web account passwords and other credentials; all you need to do is to connect your etoken to the computer and enter your etoken password. WSO integrates into your browser with a user-friendly toolbar that enables you to easily save web form credentials on the etoken, automatically fill in saved web forms, and manage your saved credentials. etoken stores much more than passwords it can securely hold all logon information including PIN numbers, account numbers, credit card details, telephone numbers, URLs, expiration dates and account notes. etoken Network Logon The etoken Network Logon application provides a cost-effective and secure method for implementing tokenbased strong authentication to networks. etoken can store your username, password, and domain name for network access and communicates with the Microsoft network logon (GINA) mechanism. All you need to do is connect your etoken and enter the etoken password to gain network access. etoken Network Logon includes robust enterprise level management - The etoken Network Logon offering is fully integrated with the Aladdin s etoken Token Management System (TMS), providing full deployment and life cycle management capabilities for all of your users tokens and the etoken network logon solutions associated with them. ADVANCED PASSWORD MANAGEMENT A l a d d i n. c o m / e T o k e n 6

8 Identity & Token Management etoken Token Management System (TMS) The etoken Token Management System (TMS) is a robust system that provides full life-cycle management of the etoken solution within an organization. TMS links security devices with users, organizational rules, and the associated security applications in a single automated and fully configurable system, enabling centralized management of any mix of etoken authentication devices and technologies including PKI, OTP, and passwordbased authentication. etoken TMS provides powerful tools so that you can cost-effectively and conveniently handle all aspects of token life-cycle management. TMS capabilities include token deployment and revocation, web-based user self-service token enrollment and password reset, automatic backup and restore of user credentials, handling of lost and damaged tokens including a solution for employee-on-the-road lost token situations, and much more. etoken TMS has an open, standards-based architecture, based on configurable connectors for integrating with a wide variety of security applications including single sign-on, certification authorities, disk encryption applications, and more. Seamlessly integrated into Microsoft Active Directory (or operated in a standalone, e.g. shadow domain mode), TMS enables you to intuitively manage tokens throughout the organization, and transparently links token management with user organizational policies. TMS includes a robust SDK for integration and management of third-party security applications. To give you peace of mind and enable compliance with regulations, TMS was designed with security in mind. A role-based access mechanism for administrators and encryption of user data ensures that only authorized individuals gain access to sensitive user information stored on the system. In addition, TMS offers comprehensive auditing and reporting capabilities for tracking of the token inventory and usage. For additional information regarding etoken security applications etoken Overview

9 SOLUTION PARTNERS etoken Enabled Third-Party Applications etoken Software Developer s Kit (SDK) If your organization is developing customized security applications or any application such as e-banking or e-healthcare that can benefit from strong user authentication and digital signatures, the etoken Software Developer s Kit (SDK) is for you. The etoken SDK provides everything you need to integrate etoken security functionality into your applications. This user-friendly SDK includes a set of industry standard APIs and supporting documentation, enabling seamless integration with third-party applications. The etoken SDK uses standard security interfaces for Windows, Linux, Microsoft CAPI, and PKCS#11 interfaces, and enables integration with boot protection security solutions which require logon prior to operating system loading. The etoken SDK supports the entire suite of etoken devices and form factors, giving you a high level of flexibility in developing etoken-based solutions. In addition, the entire etoken suite of security applications can be integrated into any third-party solution developed with etoken SDK, enabling you to further enhance your solution offering. etoken Solution Partners etoken integrates with a variety of third-party applications from leading security companies. Together with its solution partners, etoken offers you a comprehensive set of security solutions for all of your organization s needs. Partner* Boot Protection & Disk Encryption Protection CA/PKI Single Sign On VPN & Web Remote Access Network/ Workstation Logon Other Check Point Cisco Router provisioning Citrix CA Entrust HID Proximity IBM Microsoft Novell PGP RSA SafeBoot SAP Utimaco VeriSign Code signing For additional information - *Partial list A l a d d i n. c o m / e T o k e n 8

10 DEVICES Choosing the Right etoken Device etoken s suite of devices allows organizations complete flexibility to meet their individual needs. From USB tokens for PCs and remote environments, to smartcards for access control and identity badges etoken s accessibility, efficiency and portability mean it s the smart choice for organizations looking to stay ahead in today s ever changing, digitalized world. All devices support the same security interfaces and work seamlessly with etoken and third-party security applications. etoken PRO etoken PRO is a USB, readerless smartcard. It is a low cost device that enables strong, two-factor authentication and is easy to deploy. etoken PRO s secure, on-board RSA 1024-bit and 2048-bit key operations enable seamless integration into any PKI or other security architectures. etoken NG-OTP etoken NG-OTP is a hybrid USB and One Time Password (OTP) token, offering all of the functionality of etoken PRO with the addition of OTP technology for strong authentication in detached mode. etoken NG-OTP integrates multiple strong authentication methods and enables a wide variety of security related solutions, all in one device. etoken NG-FLASH etoken NG-FLASH offers the same functionality as etoken PRO, with the addition of Flash memory for mobile data storage. etoken PRO Smartcard etoken PRO Smartcard offers the same functionality as etoken PRO USB, but with a traditional credit card form factor. The etoken PRO Smartcard is operable with a standard smartcard reader. etoken PASS etoken PASS is a compact and portable one-time password (OTP) token providing strong user authentication to network resources. Proximity (Physical) Access etoken can integrate with proximity access solutions, combining both physical access and logical access in one device. Proximity technology can be integrated with both USB and smartcard etoken form factors. etoken Certifications The Aladdin etoken meets the highest industry standards and certifications. Product Certifications: etoken PRO 32K has tested compatible with Cisco Integrated Services Routers (ISR) 1800/2800/3800. etoken PRO 32/64K and etoken NG-OTP were tested compatible with Cisco Concentrator , Cisco PIX 501 v6.3(3)and Cisco ACS v3.3 Go to for full disclaimer. 9 etoken Overview

11 Technical Specifications etoken PRO Specifications Operating systems Windows 2000/XP/2003/Vista Mac OS X, Linux (32K and 64K token models only) API & standards support PKCS#11 v2.01, Microsoft CAPI, PC/SC,X.509 V3 certificate storage, SSL v3, IPSec/IKE Models (by memory size) 32K, 64K (Siemens CardOS) 72K (Java Virtual Machine) On board security algorithms RSA 1024-bit / 2048-bit, DES, 3DES (Triple DES), SHA1, SHA256 Security certifications FIPS L2&3; Common Criteria EAL5/EAL5+ (smart card chip) / EAL4+ (smart card OS) Pending: FIPS and CC EAL4 (certifications differ per model; please inquire) ISO specification support Support for ISO to 4 specifications Water resistance certification IP X8 IEC 529 Casing Hard molded plastic, tamper evident Memory data retention At least 10 years Memory cell rewrites At least 500,000 etoken NG-OTP Specifications Operating systems Windows 2000/XP/2003/Vista; Mac OS X; Linux API & standards support PKCS#11 v2.01, Microsoft CAPI, PC/SC, X.509 v3 certificate storage, SSL v3, IPSec/IKE Models (by memory size) 32K, 64K (Siemens CardOS) On b oard security algorithms RSA 1024-bit / 2048-bit*, DES, 3DES (Triple DES), SHA1 (*) Available with 64K model Security certifications Common Criteria EAL5/EAL5+ (smart card chip) / EAL4+ (smart card OS); Pending: FIPS OTP security algorithm OATH compliant (based on HMAC/SHA1) ISO specification support Support for ISO to 4 specifications Casing Hard molded plastic Battery lifetime 10,000 OTP generations / 5 years Memory data retention At least 10 years Memory cell rewrites At least 500,000 etoken NG-FLASH Specifications Operating systems Windows 2000/XP/Vista; Mac OS X; Linux API & standards support PKCS#11 v2.01, Microsoft CAPI, PC/SC, X.509 v3 certificate storage, SSL v3, IPSec/IKE Smart card memory 64K (Siemens CardOS) Flash memory options 256MB, 512MB, 1GB, 2GB, 4GB On board security algorithms RSA 1024-bit / 2048-bit, DES, 3DES (Triple DES), SHA1 Security certifications Common Criteria EAL5/EAL5+ (smart card chip) / EAL4+ (smart card OS); Pending: FIPS ISO specification support Support for ISO to 4 specifications Casing Hard molded plastic Smart card memory data retention At least 10 years Smart card memory cell rewrites At least 500,000 etoken PRO Smartcard Specifications Operating systems Windows 2000/XP/2003/Vista Mac OS X, Linux (32K and 64K token models only) API & standards support PKCS#11 v2.01, Microsoft CAPI, PC/SC, X.509 v3 certificate storage, SSL v3, IPSec/IKE Models (by memory size) 32K, 64K (Siemens CardOS) 72K (Java Virtual Machine) On board security algorithms RSA 1024-bit / 2048-bit, DES, 3DES (Triple DES), SHA1, SHA256 Security certifications Common Criteria EAL4+/EAL5+ (smart card chip and OS) Pending: CC EAL4 (certifications differ per model; please inquire) ISO specification support Support for ISO to 4 specifications Memory data retention At least 10 years Memory cell rewrites At least 500,000 etoken PASS Specifications OTP security algorithm OATH compliant (based on HMAC-SHA1) Battery lifetime 14,000 clicks / 7 Years Casing Hard molded plastic A l a d d i n. c o m / e T o k e n 10

12 About Aladdin Aladdin (NASDAQ: ALDN) is a leader in digital security, providing solutions for software Digital Rights Management and Internet security since Serving more than 30,000 customers worldwide, Aladdin products include: the USB-based etoken device for strong user authentication and password management; the esafe line of integrated content security solutions that protect networks against malicious, inappropriate and nonproductive Internetborne content; and the HASP family of leading software Digital Rights Management products. To learn more, visit the Aladdin Web site at For more contact information, visit: North America T: , UK T: Germany T: France T: Benelux T: Spain T: Italy T: Israel T: China T: India T: Japan T: All other inquiries T: /10/2007 Aladdin Knowledge Systems, Ltd. is a registered trademark and etoken is a trademark of Aladdin Knowledge Systems Ltd. All other product names are Printed in Israel trademarks or registered trademarks of their respective owners